Affected: AlmaLinux:8: attr, AlmaLinux:8: libattr, AlmaLinux:8: libattr-devel

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.

Security Fix(es):

* attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Affected: openEuler:24.03-LTS-SP1: attr

A set of tools for manipulating extended attributes on file system objects, in particular getfattr(1) and setfattr(1). An attr(1) command is also provided, which is largely compatible with the SGI IRIX tool of the same name. Security Fix(es):

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.(CVE-2026-54371)

acl-2.4.0-1.1 on GA media

attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr

Affected: Rocky Linux:8: attr

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.

Security Fix(es):

* attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security update for acl, attr

Affected: Ubuntu:Pro:14.04:LTS: attr, Ubuntu:Pro:16.04:LTS: attr, Ubuntu:Pro:18.04:LTS: attr, Ubuntu:Pro:20.04:LTS: attr, Ubuntu:22.04:LTS: attr, Ubuntu:24.04:LTS: attr, Ubuntu:25.10: attr, Ubuntu:26.04:LTS: attr

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux (attr) ausnutzen, um seine Privilegien zu erhöhen.